diff --git a/services/maintenance/apps/ariadne-deployment.yaml b/services/maintenance/apps/ariadne-deployment.yaml
index 1e0e3ca3f..aeaf194a9 100644
--- a/services/maintenance/apps/ariadne-deployment.yaml
+++ b/services/maintenance/apps/ariadne-deployment.yaml
@@ -465,7 +465,13 @@ spec:
             - name: ARIADNE_HERMES_AUTOREMEDIATION_ENABLED
               value: "true"
             - name: ARIADNE_HERMES_ALLOWED_ACTIONS
-              value: repair_demo_fixture
+              value: repair_demo_fixture,retry_transient_infra
+            # Each classification maps to exactly one action id. A diagnosis
+            # whose classification is absent here can never reach an action,
+            # and a diagnosis asking for an action that is not its
+            # classification's own is refused before anything runs.
+            - name: ARIADNE_HERMES_ACTION_CLASSIFICATIONS
+              value: known_demo_fixture_failure=repair_demo_fixture,transient_infra_failure=retry_transient_infra
             - name: ARIADNE_HERMES_MIN_CONFIDENCE
               value: "0.85"
             - name: ARIADNE_HERMES_MAX_ACTIONS_PER_INCIDENT